Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e8a51d54a18e127…

MALICIOUS

PDF

43.9 KB Created: 2020-03-31 06:39:31 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ffc2e5a5e7c204e2228649cc5a02ebd7 SHA-1: 7729f53f0dbe563ebf649d5d6ca056e737903e6c SHA-256: 9e8a51d54a18e127c409e2a94ed68505f16ed7423bcde5d2423f778c7db0096e
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or SEO abuse tactic. The document body contains a seemingly nonsensical phrase and metadata indicating it was generated by wkhtmltopdf, further supporting the idea that this is not a legitimate document but rather a vehicle for distributing links. The primary goal appears to be directing users to these external sites, which could host further malicious content or phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cardsagainstcurriculum.org/uploads/1/3/0/5/130551287/130551287.html#take+apart+lazy+boy+recliner+couch
    • http://tmttriotruckingllc.com/uploads/1/3/0/2/130287445/xexajovofupalebipere.pdf
    • http://excepxional.com/uploads/1/3/0/7/130739924/67a110aa3d2e9b.pdf
    • http://sharadyoga.com/uploads/1/3/0/5/130588380/sifutifomezolif.pdf
    • http://abodebuyer.com/uploads/1/3/0/4/130489499/pironokesukot-lajez-kuvunomukufulaw.pdf
    • http://dropoutexchange.com/uploads/1/3/0/9/130969459/5013444.pdf
    • http://vzprotech.com/uploads/1/3/0/2/130271244/javel.pdf
    • http://bluelinemartialarts.com/uploads/1/3/0/4/130435562/besako.pdf
    • http://igorandric.com/uploads/1/3/0/6/130603767/3170048.pdf
    • http://hopeforthehomelessmission.com/uploads/1/3/1/3/131398129/ripen.pdf
    • http://baboinbri.net/uploads/1/3/0/9/130968933/1429025.pdf
    • http://ncbwomen.com/uploads/1/3/0/5/130539053/takuvigupiviner.pdf
    • http://thebelfastreview.com/uploads/1/3/0/5/130540554/potubuvamigubu.pdf
    • http://legalpdq.com/uploads/1/3/0/7/130739143/manamebe-gunujo-kokuf.pdf
    • http://personaprcommunications.com/uploads/1/3/1/0/131070325/6122519.pdf
    • http://hoodoohealing.com/uploads/1/3/0/6/130620674/a1f0caa9c4.pdf
    • http://willhinkley.com/uploads/1/3/0/6/130620438/doxal.pdf
    • http://dmnroundtable2020.com/uploads/1/3/1/3/131384713/sikipixevi-kifepatetudosu.pdf
    • http://medwaybaptist.com/uploads/1/3/0/7/130740371/98fe3459722fd.pdf
    • http://bayoubaseball.net/uploads/1/3/0/7/130739343/2427bd61b6d20f.pdf
    • http://rachelcunninghaminteriors.com/uploads/1/3/0/4/130483728/bb00df3b0.pdf
    • http://imachinesgroup.com/uploads/1/3/0/8/130814863/a4030b.pdf
    • http://nkdesigns.ca/uploads/1/3/0/4/130492441/f0472a4cb2e150f.pdf
    • http://christinemadeline.com/uploads/1/3/0/2/130289322/0fa2c83830.pdf
    • http://ktecobox.com/uploads/1/3/0/5/130551534/ninel_vipotego.pdf
    • http://www.cravecookiedough.com/uploads/1/3/0/5/130588762/debumureg_nutoxuto_katuxezufibas.pdf
    • http://www.cravecookiedough.com/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008076.bin
9c8616eb4ee8ad138e7f8fc0e38ea3139ca51f0a448b57e49112eb167017ce3c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8076 8664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.